What happened
On October 23, the PHP project published an informational security advisory for CVE-2026-115560, a potential code-execution issue involving session upload progress. The notice followed emergency updates on October 21 that addressed two more broadly dangerous PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The new issue is distinct and remains possible on the newly patched versions, but only under a restrictive combination of conditions: an application configures the session serializer as php_binary or php_serialize, changes it to php at runtime before starting a session, and keeps session upload progress enabled. The Hacker News independently reported the advisory on October 23. PHP plans to address the additional issue in its routine release cycle rather than issue another emergency patch.
Why it matters
Security guidance can change within days of a major patch release. Administrators who completed the October 21 upgrade should not assume it resolves every newly documented path, while people reading only the new CVE headline should not assume that all PHP sites are equally exposed. The unusual serializer-switching behavior matters: PHP explicitly says applications that never change the handler at runtime are not exposed to this particular issue. The general lesson is to read precise prerequisites in a vendor advisory and separate fixes, temporary mitigations and conditions that may not apply. This is especially relevant to hosting providers supporting many distinct PHP applications and configurations.
What to watch next
PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release for protection against this narrow vector; installations that already followed that advice after the October 21 advisory do not need to repeat it. Site operators should verify their configuration with their provider, follow official PHP release notices and test changes against application requirements. The earlier critical PHP2Shell issues still require patched PHP releases or supported vendor backports; a web application firewall is not a substitute for underlying updates. Watch for the full advisory, a shipping fix and credible evidence of real-world use of the separate issue.